CVE-2024-24562 - CVE House

Back to Database

Status published Medium CVE-2024-24562

Security headers not set in vantage6-UI

5.4 CVSS

Vulnerability Description

vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-24562

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from vantage6

View All →

Vantage6 Server JWT secret not cryptographically secure

vantage6 lacks brute-force protection on change password functionality

vantage6 collaboration admins can extend their influence by expanding the collaboration

Vantage6: 2FA can be circumvented with hacked email access

Username timing attack on recover password/MFA token in vantage6

Affected Vendor

vantage6

View all reports →

Affected Software

vantage6-UI

Vulnerable Versions:

<= 4.2.0

Timeline

Official Publish: March 14th, 2024

Last Modified: August 1st, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-693 CWE-668

MITRE ATT&CK TTPs

T1562 Impair Defenses

Defense Evasion

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1550 Use Alternate Authentication Material

Defense Evasion

T1485 Data Destruction

T1213 Data from Information Repositories

T1005 Data from Local System

T1078 Valid Accounts